The Relationship Between Automation Complexity and Operator Error presented by Russell Ogle, Ph.D., P.E., CSP rogle@exponent.com (630) 274-3215
Chemical Plant Control Control physical and chemical processes to maintain desired conditions Control agents Plant operator Basic process control system Greater automation does not necessarily reduce opportunity for operator error
-N. Leveson, A New Accident Model For Engineering Safer Systems, Safety Science, 42: 237-270 (2004) Automated Process Control
Reliance on Operators Operator often relied on as primary line of defense Operator intervention not always successful Accident investigation must distinguish between: Operator error System deficiency
Chemical Process Accident Normal operation Abnormal conditions Disturbance grows Containment strength exceeded Hazardous release Disturbance Operator intervention Protective systems Process equipment and control systems Procedures, training and supervision Safety instrumented systems and engineering controls
Human Error Taxonomy -Adapted from James Reason (1990) appearing in CCPS, Guidelines for Investigating Chemical Process Incidents, Second Edition. AIChE, NY (2003)
Case Study Analysis Layer of protection analysis Automation complexity Origin of operator error
Layer of Protection Analysis Independent Protection Layers (IPL): 1. Basic process design 2. Basic process control system 3. Critical alarms and operator intervention 4. Safety instrumented systems 5. Physical 1 & 2 are protection not counted devices as IPL s 6. Post-release physical protection 7. Plant emergency response 8. Community Emergency response Accident Investigation Focuses on 3, 4 & 5
Automation Complexity Low Complexity Operator is interacting with single control loop Prone to single event failures High Complexity Operator is interacting with multiple control loops Prone to multiple event failures
Operator Error Operator error defined as deviation from a desired outcome (Reason, 1990) Challenge to operator: Identify Diagnose Correct disturbance Case studies suggest that the nature of the error is a function of complexity
Case Study Background Six case studies involving operator error High and low levels of automation complexity Impact Six Fatalities Thirty Injuries >$300,000,000 property damage
Case Studies Table 1. Summary of case studies. CASE STUDY AUTOMATION COMPLEXITY AUTOMATION TECHNOLOGY Case 1 Low Local analog controller Case 2 Low Manual operation and SCADA/PLC Case 3 Low Manual operation Case 4 High DCS and SCADA/PLC SAFETY INSTRUMENTED SYSTEM No No No Inadequate OPERATOR ERROR Incorrect setpoint Wrong order of reactant addition Limiting reactant omitted Failure to detect abnormal condition Case 5 High SCADA/PLC Defeated Failure to detect abnormal condition Case 6 High DCS and SCADA/PLC Defeated Wrong control action OPERATOR RESPONSE TIME 1-2 minutes 1-2 minutes 1-2 minutes 6 hours 4 hours 30 minutes
Case Study 1 Batch Process Oven - Low Automation Complexity Parts curing operation Evaporate naphtha solvent Temperature control via circular recorder controller Temperature program via plastic cam Temperature ramp Positive ventilation Operator Deviation Explosion
Wrong Temperature Cam
Incorrectly Pre-Heated Oven Pre-Heat T T from Normal
Case Study 3 Hydrogenation Rxn - Low Automation Complexity Liquid + Catalyst + H 2 + Heat Add H 2 based on pressure Forgot to add unsaturated organic feed Manual push-button control, no interlocks Heated vessel, but H 2 not absorbed H 2 vented through relief system Overhead vapor cloud explosion
Pressure Trend Normal Operation Pressure Reaction Reaction with Hydrogen Makeup Blowdown Addition Time
Pressure Trend Deviation from Normal Pressure Rupture disc Deviation: vents reactor No Reaction Time
Case Study 4 Polymerization Rxn - High Automation Complexity Alternating batch reactors for VCM Intermediate wash/rinse cycles Installation of new Degas Tank Process interruption leads to condensed VCM in reactor Condensed VCM dumped to atmospheric vessel Atmospheric vessel rupture, vapor cloud explosion
Condensed VCM Trapped Rinse Liquid VCM
Ruptured Storage Tank
Case Study 6 Mineral Processing - High Automation Complexity Flash tank section of extraction process Electrical power outage Operator chose an uncontrolled blow- down Low MAWP vessels P transmitter ranges exceeded High rate of flashing flow; Low MAWP vessels and high P piping explode
Process Controllers
Explosion Damage
Layer of Protection Analysis Process Hazard Analysis Hazard Safeguard (layer of protection) Allocation of Safeguard Function Operator Intervention Safety Instrumented System Active Safety Device Passive Safety Device
Operator Intervention Routine Operations Process Upsets Startup Shutdown Emergency Operations Emergency Shutdown What are the operating limits? Consequences of a deviation? Steps required to correct or avoid a deviation?
Another Definition of Human Error Any significant deviation from a previously established, required or expected standard of human performance. -Dan Petersen, Human Error Reduction and Safety Management, Third Edition (1996)
What Causes Operator Error? Less than adequate... Procedures Training Supervision Communications Human Engineering Work Direction Management System
Conclusions Question the effectiveness of operator intervention Consider SIS for high hazard emergency shutdowns Low automation complexity processes are prone to single event failures fast to develop High automation complexity processes are prone to multiple event failures slow to develop